Skip to content
SafetyScorer

Safety scores

Crypto exchanges

When FTX collapsed in November 2022, about $8 billion of customer money was missing, and depositors became unsecured creditors in a bankruptcy. Money on an exchange is a loan to that company, so exchange risk is counterparty risk. We score exchanges on their hack record and whether customers were repaid (30%), proof of reserves or audited accounts (20%), licences in strict jurisdictions (20%), custody and segregation (15%), and enforcement and criminal cases (15%). We do not judge any coin as an investment.

All rated crypto exchanges

  1. #1 of 48

    Bullish

    Bullish, the NYSE-listed owner of CoinDesk, holds a New York BitLicense, a German MiCA licence, a Hong Kong platform licence and a Gibraltar DLT licence, and its Deloitte-audited 2025 accounts report no loss of customer assets. It is built for institutions, and it is only four years old.

    Score 89, grade A

  2. #2 of 48

    Swissquote

    Swissquote is a FINMA-licensed Swiss bank listed on the SIX exchange, and its crypto custody is set up so coins stay with clients if the bank fails. The CHF 100,000 deposit guarantee covers cash only, not crypto, and you get fewer coins and higher fees than at a pure exchange.

    Score 89, grade A

  3. #3 of 48

    Fidelity Crypto

    Fidelity Crypto is run by Fidelity Digital Assets, National Association, a national trust bank supervised by the OCC that has held bitcoin for institutions since 2019. We found no hack or enforcement action. The gaps are that Fidelity is private, publishes no proof of reserves, and crypto is not covered by SIPC.

    Score 87, grade A

  4. #4 of 48

    eToro

    eToro is a multi-asset broker listed on Nasdaq since May 2025, with audited accounts, a MiCA licence from Cyprus and no reported loss of client crypto to hackers. Its weaker side is conduct, with a 2024 SEC settlement over US crypto trading and an Australian case over its CFD product.

    Score 84, grade B

  5. #5 of 48

    Kraken

    Kraken has the cleanest security record of the large exchanges and the most transparent proof of reserves. It is privately held, so there are no public audited accounts yet, and it has paid several US and Australian penalties.

    Score 84, grade B

  6. #6 of 48

    Bitpanda

    Bitpanda, the Vienna broker with about six million users, has a clean security record and holds client crypto as a trustee, which keeps it out of a bankruptcy estate. It has no public proof of reserves, and in 2026 it received Austria's first published MiCA fine, a small one.

    Score 83, grade B

  7. #7 of 48

    Bitstamp

    Bitstamp is one of the most heavily licensed exchanges and has a quiet legal record. It lost about 19,000 BTC in a 2015 hack but covered every customer balance, and since June 2025 it has been part of Robinhood.

    Score 83, grade B

  8. #8 of 48

    Bitvavo

    Bitvavo, the Amsterdam exchange with more than two million customers, has never lost client money to hackers and holds a MiCA licence from the Dutch AFM. Its weak spot was the €280 million it had lent to Genesis in 2022, a loss it took on itself.

    Score 81, grade B

  9. #9 of 48

    bitFlyer

    bitFlyer, Japan's largest bitcoin exchange by volume, says it has never lost coins to an outside attack and holds licences from Japan's FSA, New York's NYDFS and, since June 2026, the EU. It is privately owned and publishes little, and a 2018 regulatory order exposed serious management failings.

    Score 80, grade B

  10. #10 of 48

    Coinbase

    Coinbase is one of the safest places to buy crypto, with audited public accounts and strict US and EU licences. Its weak spots are a 2025 leak of customer data by bribed support contractors and repeated anti-money-laundering fines.

    Score 80, grade B

  11. #11 of 48

    Robinhood Crypto

    Robinhood Crypto sits inside an audited, Nasdaq-listed broker and holds a New York BitLicense and an EU MiCA licence. Its weak points are its compliance record, including a $30 million NYDFS fine, and a 2021 breach that exposed data on about 7 million customers.

    Score 79, grade B

  12. #12 of 48

    Coincheck

    Coincheck is the exchange behind one of the largest crypto thefts in history, the 2018 NEM hack, which it repaid in yen. Since then Monex has rebuilt it under Japan's strict exchange rules, and its listed parent publishes audited accounts with the SEC.

    Score 77, grade B

  13. #13 of 48

    Gemini

    Gemini has some of the strongest custody protections of any exchange, as a New York-chartered trust company with audited accounts. Its Earn lending product froze customer assets for about 18 months, and since 2026 it serves only the US and Singapore.

    Score 77, grade B

  14. #14 of 48

    Deribit

    Deribit, the largest crypto options exchange, has been owned by Coinbase since August 2025 and is regulated by Dubai's VARA, which requires segregated client assets and full reserves. It covered a $28 million hack in 2022 itself. Its weak spot is licensing, with one regulator.

    Score 75, grade B

  15. #15 of 48

    Luno

    Luno, owned by Digital Currency Group since 2020, has no known platform hack in over a decade and publishes monthly proof of reserves with a Merkle tree, prepared with the accounting firm Moore. It is licensed by South Africa's FSCA and Malaysia's Securities Commission, but not in the US, UK, EU or Japan.

    Score 75, grade B

  16. #16 of 48

    Coinone

    Coinone, one of Korea's four big won exchanges, has no known theft from its own wallets, files audited accounts and keeps customer won at KakaoBank under Korea's 2024 user protection law. Its weak point is compliance; the FIU fined it 5.2 billion won and suspended part of its business for three months in 2026.

    Score 73, grade B

  17. #17 of 48

    VALR

    VALR, a Johannesburg exchange with more than a million users, has no known theft from its wallets and holds an FSCA financial services licence. It has had two one-off proof-of-reserves checks by Hacken, but publishes no audited accounts, offers no insurance and has no licence in a strict market outside South Africa.

    Score 70, grade B

  18. #18 of 48

    Bitso

    Bitso, Latin America's largest crypto exchange, has not reported losing customer money and publishes a monthly zero-knowledge proof of solvency. But Mexico does not license crypto exchanges, its main licence is a 2019 one from Gibraltar, and in October 2026 it moved its Brazilian retail customers to Mercado Bitcoin.

    Score 68, grade C

  19. #19 of 48

    Crypto.com

    Crypto.com is broadly licensed, including under MiCA and with a conditional US trust bank charter, and it reimbursed every customer after a 2022 account hack. It is privately held and has not published an accountant-attested proof of reserves since 2022.

    Score 68, grade C

  20. #20 of 48

    Upbit

    Upbit, run by Dunamu, is Korea's largest exchange and works under one of the strictest exchange laws in Asia, with bank-held cash and audited accounts. It has lost money to hot-wallet thefts twice, covering both itself, and is contesting a 35.2 billion won anti-money-laundering fine.

    Score 68, grade C

  21. #21 of 48

    Uphold

    Uphold has no reported theft from its own wallets and shows assets against customer obligations on a live page. But in April 2026 it paid $5 million to settle New York claims over the CredEarn product, it has no EU MiCA licence, and no accountant attests its reserves.

    Score 64, grade C

  22. #22 of 48

    Mercado Bitcoin

    Mercado Bitcoin, Brazil's oldest and largest local exchange, has no known platform hack and says its accounts are audited every year. But it publishes no proof of reserves, its central bank authorisation is still in process, and it has faced a revoked CVM stop order and a large civil ruling tied to a co-founder.

    Score 63, grade C

  23. #23 of 48

    Binance.US

    Binance.US is a separate US company with 32 state money transmitter licences and no known hack. Its weak spots are the link to Binance and its founder, which cost it state licences in 2024, and the lack of any published proof of reserves or audited accounts.

    Score 62, grade C

  24. #24 of 48

    WhiteBIT

    WhiteBIT, founded in Kharkiv in 2018 and now run from Vilnius, has no known loss of customer funds to hackers. But accounts on whitebit.com sit with a Panama company, it publishes no proof of reserves, and its Austrian MiCA licence covers a separate EU platform that had not launched in October 2026.

    Score 62, grade C

  25. #25 of 48

    OKX

    OKX has a clean hack record, a monthly proof of reserves and, since 2025, an EU MiCA licence and a US launch. Its legal record is weak, after a 2025 US guilty plea for running an unlicensed money transmitting business.

    Score 61, grade C

  26. #26 of 48

    Paribu

    Paribu, one of Turkey's largest crypto exchanges, has no publicly reported loss of customer funds and is on the SPK's provisional list of platforms allowed to keep operating. It publishes no proof of reserves, and it drew the largest of four anti-money-laundering fines MASAK issued in 2022.

    Score 61, grade C

  27. #27 of 48

    Bybit

    Bybit absorbed the largest crypto theft on record in February 2025 without passing the loss to customers, and it publishes a monthly proof of reserves checked by Hacken. The hack still exposed weak cold-wallet controls, and the global exchange is licensed mainly outside the strictest markets.

    Score 60, grade C

  28. #28 of 48

    Swyftx

    Swyftx, a Brisbane exchange with over a million clients, has no known wallet theft or enforcement record and gained an ASIC licence in July 2026. But the licence does not cover its spot exchange, it publishes no proof of reserves, and its terms let it hold customer assets unsegregated.

    Score 59, grade C

  29. #29 of 48

    Bithumb

    Bithumb, Korea's second-largest exchange, keeps customer cash at KB Kookmin Bank under Korea's strict 2024 law and files audited accounts. But it has a long incident record, from hacks in 2018 and 2019 to the February 2026 payout error, and its own auditor found a material weakness in its controls.

    Score 58, grade C

  30. #30 of 48

    Indodax

    Indonesia's largest crypto exchange is licensed by OJK and says no customer lost money when hackers drained about $22 million from its hot wallets in 2024. Its proof of reserves is a wallet list with no liabilities or auditor, and OJK is still looking into user complaints.

    Score 57, grade C

  31. #31 of 48

    CoinDCX

    CoinDCX, run by Neblio Technologies in Mumbai, lost $44 million in July 2025 from a company account at a partner exchange and covered the loss itself, so no customer lost money. It publishes auditor-checked reserve statements with liabilities, but India has no crypto licence or rules on holding client coins.

    Score 55, grade C

  32. #32 of 48

    Nexo

    Nexo is a crypto lending and yield platform rather than a plain exchange. We found no hack of customer funds, and it uses known custodians, but it settled with the SEC and US states for $45 million in 2023, was fined in California in 2026, and no longer publishes an accountant's attestation of its reserves.

    Score 54, grade D

  33. #33 of 48

    BtcTurk

    BtcTurk, one of Turkey's largest crypto exchanges, lost about $55 million in 2024 and $48 million in 2025 when attackers took its hot-wallet keys, and says it covered both itself. It is on the SPK's provisional list but not yet fully authorised, and publishes no proof of reserves.

    Score 53, grade D

  34. #34 of 48

    Binance

    Binance is the largest crypto exchange and publishes a monthly proof of reserves, but it pleaded guilty to US criminal charges in 2023 and has no public audited accounts. Its global platform has been licensed in Abu Dhabi since January 2026, but it has no EU, UK or US licence.

    Score 52, grade D

  35. #35 of 48

    CoinSpot

    CoinSpot, run by Casey Block Services Pty Ltd in Melbourne since 2013, has no record of customers losing money and keeps most coins offline. But it publishes no proof of reserves or accounts, and until Australia's new licensing law starts in 2027 it is only registered with AUSTRAC for anti-money-laundering purposes.

    Score 52, grade D

  36. #36 of 48

    Gate.io (Gate)

    Gate has added real licences since 2025, including MiCA in Malta and a Dubai VARA licence, and publishes a Merkle-tree proof of reserves. Its predecessor lost 7,170 BTC in 2015, it is accused of hiding a large 2018 hack, and the global platform is still run offshore.

    Score 52, grade D

  37. #37 of 48

    BingX

    BingX, an offshore derivatives and copy-trading exchange, lost about $43 million to $52 million from hot wallets in September 2024 and said it covered every user loss itself. It publishes monthly Merkle-tree reserves, but its contracting company gives no home country and its EU licence application is still pending.

    Score 51, grade D

  38. #38 of 48

    Bitkub

    Bitkub, long Thailand's largest crypto exchange, is licensed by the Thai SEC. In July 2026 the SEC filed a criminal complaint alleging that Bitkub Online and two former directors hid the theft of about 1.7 billion baht of digital assets in 2021. Bitkub says its co-founders replaced the coins and no customer lost money.

    Score 50, grade D

  39. #39 of 48

    Bitget

    Bitget says customer balances were untouched after a $387.5 million wallet breach in September 2026, which it covered from its Protection Fund and then topped the fund back up to over $300 million. It is licensed mainly outside the strictest jurisdictions and has no MiCA licence, so EU customers have little protection.

    Score 49, grade D

  40. #40 of 48

    KuCoin

    KuCoin made customers whole after a large 2020 hack and publishes monthly reserve reports, but its legal record is among the weakest of major exchanges. It pleaded guilty to a US federal charge in 2025, was fined in Canada and New York, and Austria has not yet let its MiCA-licensed EU arm start operating.

    Score 49, grade D

  41. #41 of 48

    CoinEx

    CoinEx announced on 15 September 2026 that it is shutting down. Trading has ended and withdrawals stay open until 22 December 2026. Before that it was an unlicensed offshore exchange that covered users after a 2023 hack analysts linked to North Korea's Lazarus Group.

    Score 45, grade D

  42. #42 of 48

    MEXC

    MEXC has no record of a large hack and publishes monthly reserve figures checked by Hacken, but it is not licensed in any jurisdiction we checked. Seychelles says its operator never applied for a licence, Dubai fined it in 2026 for serving residents without one, and a 2025 row showed its power over user accounts.

    Score 45, grade D

  43. #43 of 48

    Phemex

    Phemex lost an estimated $70 million to $85 million when attackers drained hot wallets on 16 blockchains in January 2025, and promised to cover users. It publishes monthly Merkle-tree reserves without an outside verifier, is unlicensed in strict markets, and Ontario banned and fined it in 2025.

    Score 45, grade D

  44. #44 of 48

    LBank

    LBank has no reported theft of customer funds since it launched in 2015, but it is an offshore exchange run by "LBK Exchange" under British Virgin Islands law. Japan, Ontario and the Philippines have warned that it is unregistered, and we could not find a current proof of reserves.

    Score 43, grade D

  45. #45 of 48

    HTX (Huobi)

    HTX, the former Huobi Global, promised to cover customers after two hot-wallet hacks in late 2023, but it has no licence in a strict jurisdiction, its reserve reports are self-published, and Malaysia ordered it out in 2023. Treat it as an offshore platform for small, short-term balances at most.

    Score 39, grade F

  46. #46 of 48

    Bitfinex

    Bitfinex is one of the oldest exchanges and eventually repaid customers after the 2016 hack, but only after cutting every account by 36%. It publishes no audited accounts or liability-based proof of reserves and is licensed mainly in El Salvador.

    Score 37, grade F

  47. #47 of 48

    WazirX

    WazirX lost more than $230 million in a July 2024 hack, froze withdrawals for 15 months and repaid users through a Singapore court scheme that returned about 85% of balances up front. It reopened in October 2025 with BitGo as custodian, but its only regulatory status is an Indian anti-money-laundering registration.

    Score 31, grade F

  48. #48 of 48

    Nobitex

    Nobitex, Iran's largest crypto exchange, lost more than $90 million in June 2025 when attackers sent its hot-wallet funds to addresses no one controls. Since June 2026 the company and its leaders have been on the US Treasury's SDN sanctions list, which exposes anyone dealing with it to sanctions risk.

    Score 30, grade F